Detecting and preventing unauthorized credential change
Techniques include securely accessing data associated with at least one identity capable of accessing one or more access-controlled network resources; generating an intermediate value based on the data associated with the at least one identity; generating, based on application of a secret logic algorithm to the intermediate value, a secret data element; making available, the secret data element, to be embedded in an authentication credential associated with the at least one identity; identifying an attempt to change the authentication credential, the attempt including new authentication credential data to replace data in the authentication credential; validating, conditional on a determination whether the new authentication credential data includes the secret data element in a predefined location, the attempt to change the authentication credential; and determining, based on the validating, whether to perform a control action based on the new authentication credential data.
1. A non-transitory computer readable medium including instructions that, when executed by at least one processor, cause the at least one processor to perform operations for controlling changes to authentication credentials, the operations comprising:
securely accessing data associated with at least one identity capable of accessing one or more access-controlled network resources, wherein the data associated with the at least one identity includes information enabling identification of the at least one identity;
generating an intermediate value based on the data associated with the at least one identity, wherein the intermediate value the information enabling identification of the at least one identity; generating, based on application of a secret logic algorithm to the intermediate value, a secret data element;
making, the secret data element, together with a randomized data portion, available to be embedded in an authentication credential associated with the at least one identity;
identifying an attempt to change the authentication credential by the at least one identity, the attempt including new authentication credential data to replace data in the authentication credential;
validating, conditional on a determination whether the new authentication credential data includes the secret data element in a predefined location, the attempt to change the authentication credential, wherein the secret data element in the predefined location is generated by the at least one identity using the secret logic algorithm and the data associated with the at least one identity; and
determining, based on the validating, whether to perform a control action based on the new authentication credential data.
2. The non-transitory computer readable medium of claim 1 , wherein the data associated with the at least one identity includes at least one of: identity representation information, group relationship information, historical identity data, identity access information, or identity origin information.
3. The non-transitory computer readable medium of claim 2 , wherein the group relationship information includes at least one unique identifier for a group associated with the at least one identity.
4. The non-transitory computer readable medium of claim 2 , wherein the representation of the at least one identity includes an image.
5. The non-transitory computer readable medium of claim 1 , wherein the data associated with the at least one identity includes at least one of: a unique identifier of the at least one identity, a name of the at least one identity, a unique identifier of a group associated with the at least one identity, a creation date, a historical access log, a permission assigned to the at least one identity, a network address associated with the at least one identity, properties of an activity performed by the at least one identity, or an image associated with the at least one identity.
6. The non-transitory computer readable medium of claim 1 , wherein the data associated with the at least one identity includes a combination of two or more categories of data.
7. The non-transitory computer readable medium of claim 1 , wherein generating the secret data element includes performing one or more hashing functions to the data associated with the at least one identity.
8. The non-transitory computer readable medium of claim 7 , wherein performing the one or more hashing functions includes concatenating two or more data elements of the data associated with the at least one identity.
9. The non-transitory computer readable medium of claim 7 , wherein performing the one or more hashing functions includes applying a summation function to the data associated with the at least one identity.
10. The non-transitory computer readable medium of claim 1 , wherein the control action includes rejecting the new authentication credential data.
11. The non-transitory computer readable medium of claim 1 , wherein the control action includes generating an alert identifying the new authentication credential data as a candidate to include a security risk.
12. A computer-implemented method, executed by one or more hardware processors, for controlling changes to authentication credentials, the method comprising:
securely accessing data associated with at least one identity capable of accessing one or more access-controlled network resources, wherein the data associated with the at least one identity includes information enabling identification of the at least one identity;
generating an intermediate value based on the data associated with the at least one identity, wherein the intermediate value includes the information enabling identification of the at least one identity;
generating, based on application of a secret logic algorithm to the intermediate value, a secret data element;
making, the secret data element, together with a randomized data portion, available to be embedded in an authentication credential associated with the at least one identity;
identifying an attempt to change the authentication credential by the at least one identity, the attempt including new authentication credential data to replace data in the authentication credential;
validating, conditional on a determination whether the new authentication credential data includes the secret data element in a predefined location, the attempt to change the authentication credential, wherein the secret data element in the predefined location is generated by the at least one identity using the secret logic algorithm and the data associated with the at least one identity; and
determining, based on the validating, whether to perform a control action based on the new authentication credential data.
13. The computer-implemented method of claim 12 , wherein the method is performed by an agent on the one or more access-controlled network resources.
14. The computer-implemented method of claim 12 , wherein the method is performed by a credential validation resource associated with a secure credentials repository that securely maintains the data associated with the at least one identity.
15. The computer-implemented method of claim 12 , wherein the method is performed by a system configured to intercept a network traffic directed to the one or more access-controlled network resources.
16. The computer-implemented method of claim 12 , wherein the method is performed by a system that securely maintains the data associated with the at least one identity.
17. The computer-implemented method of claim 12 , wherein the method is performed by a system remote from a secure credentials repository that securely maintains the data associated with the at least one identity.
18. The computer-implemented method of claim 12 , wherein the control action includes one or more of: disabling network access for the at least one identity; monitoring activity of the at least one identity; rotating the new authenticating credential data; modifying one or more access permissions for the at least one identity; displaying a request for re-authentication to the at least one identity; or registering the new authentication credential data in a credential repository.
19. The computer-implemented method of claim 12 , wherein the control action is performed on the one or more access-controlled resources, including at least one of: isolating the one or more access-controlled resources from the network, suspending the one or more access-controlled resources, performing forensic analysis, and restoring previous states of the one or more access-controlled resources.